Penetration testing has become a mandatory aspect of keeping IT systems secure around the world today. With hacking now an ever-present threat to the security of most major organizations, governments, and businesses worldwide, IT engineers have had to develop highly specialized skills to keep up with potential hackers. Some are simple joy seekers, others political activists, still more cyber thieves looking for anything and everything to steal from credit cards, personal identities to trade secrets—and all of them looking to wreak some havoc in our daily lives. FBI Director James Comey made international headlines in 2014 when he boldly stated that only two kinds of companies exist in the USA today: "those that have been hacked . . . and those that don't know they've been hacked." This harsh reality beats home the need not only for better and tighter security but also more and better training and education for those who work to offer and protect cyber activity.

The Cost of Black Hatters to Industry, Government, And Business

Costs of hacking, both to keep the hackers out and from the damage that successful hacking causes, is enough to keep anyone who heads up an IT department-wide awake in the wee hours of the night. The total cost is difficult to estimate fully since lost business can be difficult to quantify. How much business did Target lose as a result of its high-profile hack attack in 2014, for instance? In 2015, estimates suggested that cyber-attacks cost the average business in the United States more than $15 million in revenue; that's more than twice the losses experienced by organizations in other countries. So keeping cyber world secure and cyber businesses up and running is an increasing imperative when there's a multi-billion-dollar price tag attached to it.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Why Is Penetration Testing So Challenging?

The issues involved in penetration testing are complex, in part because the cyber system has grown so big, so fast, is worldwide, and there are just so many various places and ways that the system can be penetrated. The three most prevalent areas of threat include the network itself, the hardware that is used and the software that the business employs to conduct its affairs. Each of these areas requires extensive expertise to understand and fully protect it from cyber security threats—that can come from without, or from within, the organization. And as the complexity of the cyber system has grown, so has the demand for more expertise to deal with the hacker problem.

Hands On Training

In response to the rising cost of cyber system breaches, educational institutions of all kinds have begun to develop and incorporate methods to test security systems at every level of the network and internal systems. Thus, penetration testing or ethical hacking has become a primary method that business, government, and other organizations use in order to identify and fix potential weaknesses in their infrastructure and network operations. In essence, a so-called ethical hacker tries to get into your computer system and show how it could be compromised so that you can then plug the leak(s) and protect your company's data and information.

So You Want to Become a Penetration Tester

Becoming a penetration tester may not require a specialized degree, although you may want to start with a generalized program in computer science or a related field. And even if you start out as an ethical or "white hat" hacker, you can move on to other fields throughout your career, such as incidence response or computer forensics, to name only a few possibilities. As you might expect in a field as broad and far-reaching as penetration testing, the field also offers a wide range regarding salary potential, running from lows of about US $50,000 per year and highs peaking around US $120,000 per year. These salaries vary according to job title, experience, and training, responsibilities you might have, signing or annual bonuses, benefits, and other considerations. Regardless, though, the job is a good one, and there are no signs of demand slowing down for people who are trained in it. Jobs for cyber security grew 74 percent from 2007 to 2013 according to one source, twice as fast as other IT jobs—most of which also offer good career paths.

Some Choices for Your Future

So what specific areas of specialization can you choose for your future as a penetration testing expert? There are many good choices, and this list only begins to describe a few of them. First, you could consider the areas that fall under the Infosec Institute (IARB). Here, you could choose to become a Certified Penetration Test (CPT) or a Certified Expert Penetration Test (CEPT). Both are great areas to pursue with CEPT training you to expert levels of understanding potential attacks to networks, software, and computer systems. Both these choices can also be completed in a boot camp style training approach, discussed below. If you train for EC-Council courses and programs, you might become a Licensed Penetration Tester (LPT) where you learn a set protocol to hack ethically and test computer systems and online networks. Or, become a Certified Ethical Hacker (CEH) and learn how the bad guys do it . . . so you can learn how to stop them.

There are other areas that might interest you, such as the Global Information Assurance Certification (GIAC), which covers a broad range of courses and programs related to computer security. If wireless systems interest you, consider the GIAC in wireless systems, GIAC GAWN, that will teach you how to analyze and evaluate the weaknesses in this type of network system. The GIAC in mobile devices, GMOB, can help you to understand how these systems can be exploited and hacked. The GIAC in web application testing, the WAPT, could be another area to pursue. One other in a broad range of areas to consider could also be specialization in penetration testing with a GIAC GXPN designation. All of these fields are expanding and could lead to an exciting future for you.

But if these areas are not what you want to do in the near future, at least, consider the area of offensive security training and the services you could learn and provide and various certifications that are available. Lots exist, and the ones listed here are just the more popular ones you might want to explore. There are four you might consider including Offensive Security Certified Professional (OSCP), Offensive Security Wireless Professional (OSWP), Offensive Security Certified Expert (OSCE) and Offensive Security Exploitation Expert (OSEE).

Another way to go might be through CREST. CREST is a not for profit company that offers certifications that ensure any company offering the many kinds of security for networks, computers, and computer systems is fully qualified and prepared to do so. The certifications are long and lengthy. Some that you might consider include becoming an expert in infrastructure training as a CREST CCT or an expert in web applications. A CREST CRT is an entry-level examination to become a registered penetration tester, a great way to begin a career in vulnerability assessment and how to conduct penetration testing itself.

Rapid7 is a private company that operates around the world to collect and analyze hacker information to ensure that your company's network is as well protected as possible. You can also earn certifications from this company including as a Nexpose Certified Administrator, Nexpose Advanced Certified Administrator, or even as a Metasploit Certified Specialist. And the good news is that many of these programs and courses can be taken as weekend training or short course boot camp style training that might fit easily into your lifestyle and career path.

Boot Camps: A Good Choice for Training

An important consideration if you're thinking about a future as a penetration tester is that in this field experience generally beats education, so boot camps may be a great choice if you are just entering the field, rather than formal university of college training. Boot camps are just that: tough and practical, near real, simulations of actual possible hacker scenarios that you explore throughout the boot camp experience. This method of training can prepare you for the practical realities of life in the workaday world far better than the classical in-school textbook approach to training. Certifications are also popular, although the list can be confusing, given how many of them exist. A good progression for someone just entering the field might be to start with a core program, whether at a college, technological school or university and learn the basics of IT. Find a job and spend a few years learning the trade. While you're at that, you will find areas of concentration, importance and interest, and you can then pursue specializations and certifications that will propel you along in your career. More than many fields, though, your understanding will be enhanced by practical experience, so boot camp style learning may be the best way to leapfrog into those high-income brackets mentioned earlier. A distinct advantage to this approach to learning, in addition to its real-world method, is that the programs are also intensive offerings, usually taken over a period of just a few days. You can complete the program relatively quickly, as they are often offered in short, five-day (some are shorter, some are longer) spurts of intense immersion in the topic. This method can also allow you to master new material quickly, sometimes on weekends, or even over brief vacations, and then to immediately apply the new skill to your job. This is a fantastic method of propelling yourself ahead in your career faster than traditional university approaches to education, stuck in a classroom.

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Is The White Hat for You?

The field of IT is one that will likely continue to expand for a long time to come, offering tremendous opportunities to those who enter it. The area of penetration testing is just one of an ever-increasing array of skills that are needed in this burgeoning field.